Step 1
Describe your current process
Which documents and countries you check, how many sessions a month, which checks are on, where the data is stored now and how the result reaches your system. This is the basis for the scenario.
KYC service in Russia: cloud and on-premises
The NeuroVision KYC platform from Russia comes in two options: cloud verification on servers in Russia, or installation on your company’s own servers, where customer data never leaves your perimeter. We help you meet the requirements on the localisation of personal data and move over from a foreign service without halting onboarding.
Data is stored in Russia Russian software registry no. 19972 Rospatent certificate no. 2023661508
Why a company needs a KYC service that runs in Russia
KYC for Russia: two models, one product
The core of the platform is the same in the cloud and in your perimeter; what differs is where it runs and who is responsible for maintenance.
- 01
Data localisation
Since 1 July 2025, recording, storing and retrieving the personal data of Russian citizens using databases abroad is not permitted, except for a few cases set out in the law (Art. 18, para. 5, 152‑FZ). A KYC service is exactly what collects and stores a passport, a photo and a questionnaire — so its databases have to be in Russia.
- 02
Cross-border transfer is a separate procedure
If document images go to a server abroad, that is a cross-border transfer: before it starts, the operator files a separate notification with Roskomnadzor, and data cannot be sent to countries outside the «adequate protection» list until the regulator decides (Art. 12, 152‑FZ). With a Russian service there is no such procedure.
- 03
Onboarding continuity
In 2022 some foreign verification services stopped working with Russian companies. If a KYC provider can switch you off from outside, registering new customers is at risk. A Russian developer and an installation inside your perimeter remove that risk.
- 04
Procurement and import substitution
For government customers and state-owned companies it matters that the software is in the Russian software registry: the NeuroVision platform is there under no. 19972. How to use this in a procurement is covered in the «KYC import substitution» block.
- RU cloud servers
- Docker delivery into your perimeter
- 3 months of free image storage in the cloud, then per the tariff
152‑FZ requirements for a KYC service: what your company has to do
The personal data operator is your company: you set the purposes and decide where customer data is processed. The NeuroVision cloud in Russia or an installation in your perimeter helps you meet the requirements on where data is kept, but notifications, consents and internal documents remain with you. Below is what to check before you choose a model.
- Recording, organising, accumulating, storing, updating and retrieving the personal data of Russian citizens is allowed only using databases in Russia, except for the cases in items 2, 3, 4 and 8 of Art. 6, part 1 (Art. 18, para. 5, 152‑FZ; the requirement was introduced by 242‑FZ of 21.07.2014, the current wording is 23‑FZ of 28.02.2025, in force from 01.07.2025)
- The Roskomnadzor notification states where the database with the personal data of Russian citizens is located (item 10.1, part 3, Art. 22, 152‑FZ). When you change KYC provider or move into your perimeter, update the details by the 15th of the following month at the latest (part 7, Art. 22)
- Before any transfer of personal data abroad — a separate Roskomnadzor notification, not the same as the processing notification (Art. 12, part 3, 152‑FZ)
- Before notifying — obtain from the foreign recipient details of its protection measures and the conditions for ending processing (Art. 12, part 5)
- Data cannot be sent to countries outside the «adequate protection» list while Roskomnadzor reviews the notification — 10 working days (Art. 12, parts 9 and 11)
- With the NeuroVision cloud or an installation in your perimeter, the KYC process involves no cross-border transfer
- Processing on the operator’s instructions — under a contract listing the actions and purposes (Art. 6, part 3, 152‑FZ). In the cloud model, NeuroVision processes the data on your instructions
- In your perimeter you run the processing yourself; NeuroVision engineers connect to the servers only for installation and updates, as agreed — the access procedure is set out in the contract
- Personal data protection measures and the threat model — under Art. 19, 152‑FZ. In your perimeter, your information security team provides them
- Failing to use databases in Russia when collecting personal data — a fine for legal entities of RUB 1 million to 6 million, and for a repeat offence RUB 6 million to 18 million (Art. 13.11, parts 8 and 9, Russian Administrative Offences Code)
- Failing to notify Roskomnadzor of an intention to process personal data — RUB 100,000 to 300,000 for legal entities (Art. 13.11, part 10, Russian Administrative Offences Code)
- This is a guide for a conversation with your lawyer, not a legal opinion. The wording of the provisions is a paraphrase; the exact text is in ConsultantPlus. How to build data protection across the whole customer-check process is covered in the article on protecting personal and biometric data in KYC.
- Biometric processing in KYC is governed by Art. 11 of 152‑FZ and by 572‑FZ — discuss your scenario with your lawyer.
NeuroVision cloud or installation in your perimeter: a comparison
-
Where data is processed, launch and infrastructure
Cloud — documents and results are processed on NeuroVision servers in Russia, with no cross-border transfer; launch once access is issued and the scenario is configured; you need no infrastructure of your own. In your perimeter — on your servers only, with no access to external cloud services and no cross-border transfer; NeuroVision engineers install the Docker containers over SSH or a secure channel; you need a server with a GPU — the requirements are in the on-premises block.
-
Internet, updates and scaling
Cloud — the internet is needed for API requests; models update automatically, with no effort on your side; scaling is on NeuroVision’s side. In your perimeter — the internet is not needed to operate, only to activate the licence and for updates, which can be installed as offline packages; a new version is switched on as agreed, after tests on your side; scaling — your servers, and for production two servers with a load balancer.
-
Storage, responsibility, payment and who it suits
Cloud — images are stored free for 3 months, then per the tariff, and the retention period for results is set in the scenario; NeuroVision is responsible for protecting personal data on its servers, on your instructions; you pay for completed checks, with no subscription fee; it suits online services, fintech, microfinance companies and marketplaces that need a fast start. In your perimeter — storage under your own rules; your information security team is responsible for protecting personal data; payment is a licence; it suits banks, state-owned companies, healthcare and anyone with an isolated perimeter.
The platform’s functions are the same in both options — what changes is where the data is processed and who maintains the system. Cloud verification suits a fast start; an installation in your perimeter suits cases where customer data must not leave it. How to assess data-storage risks in each model and work out the total cost of ownership is covered in the article «Cloud or on-premises KYC: how to choose a data storage model».
Which model suits your company
KYC for Russia is not «one size fits all»: the choice depends on how many customers you have, who audits your infrastructure and whether you may connect to external services.
-
Banks
- Usually your own perimeter — because of information security and regulator requirements on where data is kept
- Cloud — for a pilot and for individual products Learn more
-
Government and state-owned companies
- Your own perimeter, including an isolated one with no internet access
- Software from the Russian software registry for procurement
-
Microfinance, fintech and brokers
- Cloud: a fast start, payment per check, data on servers in Russia
- Your own perimeter — as volume grows
- Learn more: Microfinance, fintech, brokers
-
Marketplaces and online services
- Cloud and the Web SDK in an app via WebView: checks on sellers and users with no infrastructure of your own Learn more
-
Large business with its own data centre
- Your own perimeter, if your security policy forbids sending customers’ and employees’ documents outside
-
On-premises: server requirements, installation and updates
-
Minimum configuration
CPU with 16 threads or more and AVX2 (AMD Ryzen 9 3900X or equivalent), NVIDIA RTX 3090 with 24 GB of video memory or equivalent (A5000, RTX 4080), 64 GB of RAM, SSD from 1 TB. Suits moderate load and a small number of parallel sessions.
-
Recommended for production
CPU with 24 threads or more (Intel Core i9-12900KF or equivalent), 2× RTX 3090 (48 GB of video memory) or equivalent (2× A5000, A6000, RTX 4090), 128 GB of RAM, SSD/NVMe from 2 TB, network from 1 Gbit/s. For high availability — two servers with a load balancer.
-
Installation and updates
Docker KYC deployment: you prepare the servers and SSH or secure-channel access, and NeuroVision engineers install the containers, configure the environment and check that it works. Model and component updates are by agreement: NeuroVision tells you the version, connects over a VPN or under your procedure, and the new version is switched on after tests.
Images and results never leave your perimeter.
The internet is needed only to activate the licence and for updates — updates can be installed as offline packages.
Platform architecture and components · On-premises questions in the documentation
KYC import substitution: documents for procurement and the security team
What to attach to a procurement or to a security team request when you replace a foreign KYC service with a Russian one. The full list of NeuroVision registry entries and certificates, with numbers and links, is on the «About the company» page.
- Check in the registry
Russian registry software for KYC
The «Neurovision» computer vision platform is included in the unified register of Russian computer programs and databases: entry no. 19972 of 13.11.2023. The register is kept by the Ministry of Digital Development under Government Resolution no. 1236 of 16.11.2015. The entry number is given in the bid and in the technical specification.
- Check in FIPS
Licence agreement and the Rospatent certificate
The right to use the platform is granted under a licence agreement with NeuroVision LLC. The platform is registered with Rospatent, certificate no. 2023661508 of 31.05.2023.
How to move from a foreign KYC service to a Russian one
You can switch without halting onboarding: first a test on your own documents, then both services running in parallel, and only then switching the old one off. Timing depends on the scenario and the model you choose — we will give it once we have reviewed your task. How a company’s KYC process is built is covered on the blog.
Step 2
Choose a model
The NeuroVision cloud in Russia or an installation in your perimeter. For your own perimeter, prepare servers to the requirements in the on-premises block.
Step 3
Test on your own documents
Test access for 1 month: set up a scenario in your account and run real documents from your customers — Russian passports, foreigners’ documents, poor-quality shots.
Step 4
Move the integration
The REST API and the Web SDK with a ready widget; in a mobile app the widget runs via WebView. The response structure is described in the documentation — map the fields to your old integration.
Step 5
Run in parallel
Part of the flow goes through NeuroVision, part through the previous service. Compare the approval rate and the share of manual reviews on identical applications.
Step 6
Switch off the old service and update your documents
Move the whole flow, ask your previous provider to delete your customers’ data, and update the Roskomnadzor notification and the personal data processing policy if the database location or the cross-border transfer has changed.
What to ask a KYC provider for before signing
A checklist for the three teams that sign off on a KYC service. You can send it to any provider, us included.
- Request documents
Information security
Where the data is and who can access it
Data
- The country and site of the servers
- Retention period for images and results
- Whether personal data can be left out of webhooks
Access
- How tokens are issued (JWT, permanent tokens; user permissions are set by role)
- Which of the provider’s staff can see the data
- Logging
Documents
- Personal data processing agreement
- A description of the protection measures under Art. 19, 152‑FZ
- Open the documentation
IT and architecture
How the service will fit into your infrastructure
Cloud
- REST API, Web SDK, webhooks
- Response time on your documents
Your perimeter
- Server requirements
- Delivery format (Docker)
- Working without the internet
- How updates are installed and who tests them
Fault tolerance
- Two servers and a load balancer
- Availability level (SLA) and support terms
- Calculate the cost
Procurement
What to attach to a bid
Software origin
- The entry in the Russian software registry and its number
- Rospatent certificate
Contract
- A licence agreement or a services agreement
- Payment model — per check or a licence
Test
- A trial period on your documents
- Closing documents every month
Connection: cloud API, Web SDK or your own perimeter
Terms
- A 1-month trial period
- A dedicated manager
- Tickets-based technical support
- Pay only for completed checks, with no subscription fee — for the cloud
How much the cloud and an installation in your perimeter cost
In the cloud you pay for completed checks, with no subscription fee and no connection fee. An installation in your perimeter is a licence; the cost depends on the modules and the load and is calculated per project.
Calculate the cost- 01
Cloud: payment per check, and the price per check falls as volume grows
- 02
Your own perimeter: a platform licence
- 03
The first month is a free test on your documents in the cloud
Licences and certificates
The project «Development of a multimodal system using artificial intelligence "Neuromed" for managing the diagnostic processes of a clinic on the basis of the "Neurovision" computer vision platform» is supported by the Innovation Promotion Foundation within the federal project «Domestic Solutions»
The Neurovision computer vision platform is registered with Rospatent (certificate No. 2023661508) and included in the Russian Software Registry (entry No. 19972 of 13.11.2023)
The right to use the Platform is granted under a licence agreement concluded by Neurovision with its customers
Read also
How data storage and the legal requirements in KYC work — on our blog
342 23
KYC, AML and Digital Identification
Local or cloud KYC: how to choose a biometric data storage model
356 16
KYC, AML and Digital Identification
How to ensure the protection of personal and biometric data in KYC processes
354 13
KYC, AML and Digital Identification
How to build a KYC policy compliant with Federal Law 115-FZ, Federal Law 152-FZ, FATF and GDPR
131 18
KYC, AML and Digital Identification
Unified Biometric System (EBS): What It Is, How to Enroll Your Biometrics, and Where It’s Used
Frequently asked questions about a KYC service in Russia
In Russia. NeuroVision cloud verification processes documents and check results on servers in the territory of the Russian Federation, so when you work through the cloud there is no cross-border transfer of personal data in the KYC process.
Only subject to two requirements of 152‑FZ: databases holding the personal data of Russian citizens must be in Russia (Art. 18, para. 5), and sending data abroad requires a separate notification to Roskomnadzor (Art. 12). If a foreign service keeps the documents with itself, meeting the first requirement is hard. The decision is your lawyer’s.
It is the requirement to record, store and retrieve the personal data of Russian citizens using databases in Russia. It was introduced by 242‑FZ in 2014, and since 1 July 2025 the rule applies as amended by 23‑FZ: foreign databases may not be used to collect such data, except for a few cases set out in the law.
It is an installation of the platform on your company’s servers. NeuroVision supplies it as a set of Docker containers, engineers install and configure the components, and documents and check results are processed and stored only on your side.
Yes. After installation the internet is needed neither for the algorithms to run nor for data storage. Access is needed to activate the licence and for updates, and updates can be installed as offline packages.
The minimum is a CPU with 16 threads or more and AVX2, an NVIDIA RTX 3090 with 24 GB of video memory or equivalent, 64 GB of RAM and an SSD from 1 TB. For production we recommend two RTX 3090 cards or equivalent, 128 GB of RAM, NVMe from 2 TB and two servers with a load balancer.
NeuroVision engineers carry out updates as agreed with you: they connect over a VPN or under your procedure, update the Docker images and models, and switch on the new version after tests on your side.
If the details in the personal data processing notification change — for example, the location of the database or whether there is a cross-border transfer — they must be updated by the 15th of the following month at the latest (Art. 22, part 7, 152‑FZ). What exactly to change in your notification is for the person responsible for personal data processing to decide.
The platform is in the Russian software registry, entry no. 19972 of 13.11.2023 — this confirms the Russian origin of the software. Which national-treatment requirements apply to your procurement under 44‑FZ or 223‑FZ is for the customer to determine.
In the cloud — payment for completed checks with no subscription fee, and the price per check falls as volume grows. An installation in your perimeter is a licence, and the cost is calculated per project. You can test the cloud free for the first month.
Let’s work out where your checks will run
Tell us how many customers you check and what your security team requires — we will suggest the cloud or an installation in your perimeter and give you test access.
Can't put your request into words? Book a call and our team will contact you at a convenient time
Book a call
The NeuroVision platform is listed in the Russian software registry, entry no. 19972. Rospatent certificate no. 2023661508.
Address: Moscow, Presnenskaya Embankment 12 — Moscow City business centre, Federation Tower. Nearest metro stations: Delovoy Tsentr and Mezhdunarodnaya.
